Method for robustly classifying pictures by using sparse network based on retention dynamics process

Abstract

The invention provides a method for robustly classifying pictures by using a sparse network based on a retention dynamic process, which combines a neural tangent kernel theory and an adversarial training dynamic process, obtains respective adversarial samples of the sparse network and a dense network by using adversarial attacks, and obtains the sparse network suitable for adversarial training. And adversarial training is carried out on the picture set by using the sparse network to obtain a classifier, so that the adversarial attack can be effectively resisted. The performance of the sparse network obtained by the method is equivalent to the performance of the original dense network, the adversarial robustness is superior to that of the recently proposed Inverse Weight Ineritance2020, the target sparse network is found during initialization, the adversarial training-pruning process does not need to be iteratively carried out like the existing method, the training time is greatly shortened, and the training efficiency is improved. Therefore, the method is superior to an existing same-task method, and deployment of the robust adversarial neural network on resource limited equipment becomes possible.

Description

technical field [0001] The invention belongs to the field of picture classification and confrontation training in machine learning, and in particular relates to a method for robustly classifying pictures using a sparse network based on a preserved dynamics process. Background technique [0002] Deep neural networks are widely used as state-of-the-art machine learning classification systems due to their huge performance gains in recent years. At the same time, as Szegedy points out, state-of-the-art deep neural networks are often vulnerable to adversarial examples that are distinguishable to the human eye but can trick classifiers into making arbitrary predictions. Such non-ideal properties may make deep neural networks unsuitable for security-sensitive applications. Various adversarial defense methods were subsequently proposed to deal with adversarial examples. However, most defense methods are quickly broken by new adversarial attack methods. Adversarial training propos...

AI Technical Summary

Problems solved by technology

However, fine-tuning a pruned model with inherited weights only yields comparable or worse performance than training the model with randomly initialized weights, suggesting that inherited "important" weights are not necessarily useful for fine-tuning

Images